Privacy Policy

This policy explains what personal information Sala Studio (“Sala”, “we”, “us”) collects, why, who we share it with and what your rights are. It covers our website, our booking pages, the Sala app, our On Demand apps and the studio itself. We follow the New Zealand Privacy Act 2020.

The information we collect

From you, when you create an account, book, buy or contact us:

• your first and last name, email address, mobile number and date of birth

• your bookings, waitlists, class attendance, membership, pauses and purchase history

• your marketing choices, with when and how you made them

• messages you send us, and anything you tell our team that they note on your account so we can look after you in class, such as an injury or a pregnancy

• a profile photo, if you add one

About payments: card payments are processed by Stripe. We keep the card’s brand, its last four digits and Stripe’s reference for it. We never see or store your full card number. On Demand subscriptions bought in the Apple App Store or Google Play are billed by that store.

From your device, when you use our website and apps:

• on our website: pages viewed, items added to cart and purchases completed, through cookies from Google and Meta

• on our booking pages and apps: a sign-in cookie or token, and a record of how the app is used that does not include your name

• when you check in with the app: your phone’s location at that moment, used only to confirm you are at the studio. We keep the distance and the check-in method, not your coordinates. We also keep a key for the one phone you check in from, and its model name

• crash reports from the app, so we can fix faults

From others: if you book with us through ClassPass, ClassPass gives us your name and booking. Where you also have an account with us, we hold your details as described here.

We do not use fingerprint, face or palm recognition, and the app does not use advertising identifiers.

How we use it

• to provide classes, memberships, On Demand and our facilities, and to manage your bookings and payments

• to contact you about your account, bookings, waitlists and payments, by email and by app notification

• to keep you and others safe in the studio, and to contact you in an emergency or about a late class change

• to make sure offers for new customers are used once per person

• to send you marketing email or notifications, only if you have agreed. You can unsubscribe at any time from any email or in your account

• to understand how our website, app and classes are used so we can improve them

• to measure and improve our advertising, as described below

• to meet our legal, tax and accounting obligations

Advertising on Facebook and Instagram

We advertise with Meta Platforms (Facebook and Instagram). To measure which ads bring people to Sala, and to decide who should and should not see our ads, we share some information with Meta:

• when you sign up online, make your first purchase or start a membership, we tell Meta that it happened, when, and the amount, along with Meta’s own click and browser identifiers from our website where we have them

• lists of our customers, for example current members, past members and people who have bought from us before, so that we can leave them out of ads for new customers, show them relevant ads, and ask Meta to find people similar to them. With one of these lists we include how many classes each person has attended

• this covers people who have attended through ClassPass as well as people who have bought from us directly

Before any of this leaves our systems, your email address, mobile number, first name, last name, date of birth and country are each converted into a scrambled code (a “hash”). Meta receives the codes, not the details themselves, and uses them to match you to a Facebook or Instagram account if you have one. We do not send Meta anything about your health, your payment card or your messages.

You can control how Meta uses information for advertising in your Facebook or Instagram ad settings.

We do not sell your personal information.

Who we share it with

We use service providers to run Sala. They hold or process personal information on our behalf, and only for the purpose shown:

• Codexfit: our current booking, membership and payments platform

• Sentio: the booking, membership and payments platform we are moving to. Its servers are in Auckland, New Zealand

• Stripe: card payments

• Apple and Google: On Demand subscriptions bought in their stores, and delivering app notifications

• Resend: sending our emails and receiving emails you send us

• Klaviyo: marketing email, if you have agreed to receive it

• Meta Platforms: advertising, as described above

• Google: Google Analytics and Google Tag Manager on our website

• Vimeo: hosting our On Demand videos

• Sentry: app crash reports

• Cloudflare: delivering our website and timetable

• Anthropic: we use its AI model to sort emails sent to us and to help our team draft replies. A person at Sala reads and sends every reply. Anthropic does not use this to train its models

• Backblaze: encrypted backups

• ClassPass: if you book through ClassPass, we confirm your booking and attendance to them

We may also disclose information where the law requires it.

Sending information overseas

Some of the providers above store and process information outside New Zealand, including in the United States, Singapore and the European Union. Those countries may not have the same privacy laws as New Zealand. We take reasonable steps to make sure these providers protect your information to a standard comparable to the Privacy Act 2020. By using our website and services you acknowledge that your information may be sent overseas on this basis.

Cookies

Our website uses cookies and similar technologies from Google and Meta to recognise your browser, understand how the site is used and measure our advertising. Our booking pages use a cookie to keep you signed in. You can control or delete cookies in your browser settings, and you can opt out of Google Analytics with Google’s browser add-on. Turning cookies off may mean parts of our website do not work as well.

How we keep it safe

Information is encrypted when it travels and our backups are encrypted. Our team see only what their role needs, and we keep a record of when staff open a member’s details. No system is perfectly secure. If a privacy breach is likely to cause you serious harm, we will tell you and the Privacy Commissioner.

How long we keep it

• your account details: for as long as you have an account

• sales, refund and payment records: 7 years, as tax law requires

• messages you send us: 3 years after the last message

• website analytics: up to 14 months. App usage records: about 13 months

• backups: 30 days

When your account is deleted we remove your name, email, mobile number, date of birth, notes, marketing choices and messages, and ask our providers to delete their copies. We keep your bookings and payments without your name. We also keep a scrambled code made from your email and mobile number, only so that an offer for new customers cannot be taken twice. To ask us to delete your account, email hello@sala.studio.

Your rights

You have the right to ask for a copy of the personal information we hold about you and to ask us to correct it. There is no charge, and we will respond within 20 working days.

If you are not happy with how we have handled your information, please contact us. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

We will update this page when what we do changes, and show the date and version at the top.

Contact us

Email hello@sala.studio or write to us at 48 Brown Street, Auckland 1021.